libs icon indicating copy to clipboard operation
libs copied to clipboard

Published 20 hours ago • verified publisher icon falcosecurity

Umbrella: Adding support for new field types in plugins

Open therealbobo opened this issue 2 years ago • 25 comments

Motivation

Currently, the plugin API only supports uint64 and charbuf field types. However, could be a good idea to add support for additional types to align with the libsinsp library.

Feature

The following types need to be added:

  • [ ] none
  • [ ] int8
  • [ ] int16
  • [ ] int32
  • [ ] int64
  • [ ] uint8
  • [ ] uint16
  • [ ] uint32
  • [x] uint64
  • [x] bytebuf
  • [ ] errno
  • [ ] sockaddr
  • [ ] socktuple
  • [ ] fd
  • [ ] pid
  • [ ] fdlist
  • [ ] fspath
  • [ ] syscallid
  • [ ] sigtype
  • [x] reltime
  • [x] abstime
  • [ ] port
  • [ ] l4proto
  • [ ] sockfamily
  • [x] bool
  • [ ] ipv4addr
  • [ ] dyn
  • [ ] flags8
  • [ ] flags16
  • [ ] flags32
  • [ ] uid
  • [ ] gid
  • [ ] double
  • [ ] sigset
  • [ ] charbufarray
  • [ ] pt_charbuf_pair_array
  • [ ] ipv4addr
  • [ ] ipv4net
  • [ ] ipv6addr
  • [ ] ipv6net
  • [x] ipaddr
  • [x] ipnet
  • [ ] mode
  • [ ] fsrelpath
  • [ ] enumflags8
  • [ ] enumflags16
  • [ ] enumflags32
  • [ ] max

Probably not all these types are useful. Additionally adding all these types, maybe, could result in performance penalties.

Tasks

  • [ ] Add support for new filtercheck types.
  • [ ] Test the new filtercheck types.
  • [ ] Ensure compatibility with driver/ppm_events_public.h.
  • [ ] Update documentation to reflect the changes.

Additional context

These types should be compatible with the types declared in the driver/ppm_events_public.h in the libs repository.

This issue will be used only for tracking.

therealbobo avatar Mar 20 '23 10:03 therealbobo

I will add milestone 0.11.0 just to track it :) Feel free to change it /milestone 0.11.0

Andreagit97 avatar Mar 20 '23 12:03 Andreagit97

Hey @therealbobo , I don't think we need all of them :) Also because perhaps the types that sinsp supports are a bit too many :)

I think it makes sense to start from a minimal list and add more when necessary

LucaGuerra avatar Mar 27 '23 16:03 LucaGuerra

You are right! I already started to work on it and implemented some basic types! 😄

therealbobo avatar Mar 27 '23 16:03 therealbobo

/assign

therealbobo avatar Apr 05 '23 08:04 therealbobo

/milestone 0.12.0

FedeDP avatar Apr 27 '23 09:04 FedeDP

/milestone 0.13.0 assuming this is a long-term task

leogr avatar May 03 '23 10:05 leogr

@leogr: The provided milestone is not valid for this repository. Milestones in this repository: [0.11.0, 0.12.0, 0.13.0, 5.0.0+driver, next-driver]

Use /milestone clear to clear the milestone.

In response to this:

/milestone 0.13.0 assuming this is a long-term task

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

poiana avatar May 03 '23 10:05 poiana

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

poiana avatar Sep 05 '23 13:09 poiana

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

poiana avatar Oct 05 '23 15:10 poiana

/remove-lifecycle stale

Andreagit97 avatar Oct 06 '23 13:10 Andreagit97

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community. /close

poiana avatar Nov 05 '23 15:11 poiana

@poiana: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community. /close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

poiana avatar Nov 05 '23 15:11 poiana

/remove-lifecycle rotten

jasondellaluce avatar Nov 06 '23 16:11 jasondellaluce

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

poiana avatar Feb 04 '24 21:02 poiana

/remove-lifecycle stale

Andreagit97 avatar Feb 06 '24 09:02 Andreagit97

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

poiana avatar May 06 '24 09:05 poiana

/remove-lifecycle stale

Andreagit97 avatar May 07 '24 09:05 Andreagit97